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TO: ALL APPLICANT AGENCIES 


The purpose of this Information Bulletin is to advise all applicant agencies of the requirements for access to 
State and federal Criminal Offender Record Information (CORI) and to reiterate CORI security requirements. 


Definition of CORI 

CORI means records and data compiled by criminal justice agencies for purposes of identifying criminal 
offenders. For each offender, CORI may include a summary of arrests, pretrial proceedings, the nature and 
disposition of criminal charges, and information pertaining to sentencing, incarceration, rehabilitation, and 
release. Criminal justice agencies throughout the state provide this information to the California Department of 
Justice (DOJ), which in turn is required to maintain it in a statewide repository. 1 


Statutory Authority Required 
All agencies must have express statutory authority to submit fingerprint-based requests for CORI.? 


To conduct Federal Bureau of Investigation (FBI) background checks, the authorizing statute must (1) include 
an explicit reference to a national criminal history check, (2) include an express reference (“submit to the FBI”) 
or implied reference (“submit for a national check”), (3) authorize the use of FBI records for screening of 
applicants, and (4) identify the specific category(ies) of licensees/employees that fall within its purview, to avoid 
over breadth. 


In the absence of statutory authority, an agency must work with their legislative office, legal counsel, or 
equivalent representative to pursue the requisite legislative change. 


Please contact ORIQuestions@doj.ca.gov if you have questions regarding your agency’s statutory authority. 


Approved Reasons for Fingerprinting 

The specific category of licensee/employee identified in an agency’s statutory authority constitutes an agency's 
approved reason for fingerprinting. This reason must be reflected in the “Authorized Applicant Type” and “Type 
of License/Certification/Permit OR Working Title” spaces on the “Request for Live Scan Service,” form BCIA 
8016, as prescribed by the DOJ. Please contact ORIQuestions@doj.ca.gov if you have questions regarding 
your agency’s approved reason(s) for fingerprinting and completion of the form BCIA 8016. 


It is the responsibility of an agency to understand how they are authorized to conduct background checks, to 


1 See Penal Code §§ 11075, 11105, 13102. 
2 Public Law 92-544; Penal Code § 11076. 
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track that statutory authority, and to make the DOJ aware when there has been any change to an authorizing 
statute. This awareness will assist during agency audits, as an agency will be required to provide the purpose 
of, and the reason for, their access to the CORI obtained as the result of a background check. 


Applicant Privacy Rights 
When an agency requires an applicant to submit their fingerprints for a criminal record background check to 


help determine their suitability for employment, certification, or licensing, the agency is required to inform the 
applicant of their right to privacy. This requirement is met with the issuance of the DOJ Privacy Notice, the 
FBI’s Privacy Act Statement, and the Noncriminal Justice Applicant’s Privacy Rights included on the form BCIA 
8016. 


Furthermore, when a form is used to collect personal information from an individual, a state agency is 
mandated to provide a notice informing the individual whether the inclusion of such information is mandatory or 
voluntary, and if there are any consequences for not providing all or part of the information requested. The 
notice must also include the principal purpose(s) for which the information is to be used.? This requirement is 
met with the issuance of the DOJ Privacy Notice included on the form BCIA 8016. 


Similarly, the FBI’s Privacy Act Statement, also included on the form BCIA 8016, informs applicants of the 
FBI’s authority to acquire, preserve, and exchange fingerprints and associated information.* The statement 
advises the applicant that although submission of fingerprints and associated information is voluntary, failure to 
submit information may affect completion or approval of an application. This statement further advises 
applicants how their information will be used, retained, and shared. 


An applicant who is the subject of a national fingerprint-based criminal history record check for a noncriminal 
justice purpose has certain rights under federal law. These rights, which include the opportunity to complete or 
challenge the accuracy of a criminal history record and the right to expect that officials receiving the results of 
the criminal history record check will use it only for authorized purposes, are delineated in the Noncriminal 
Justice Applicant’s Privacy Rights included on the form BCIA 8016. 


For a copy of the current version of the BCIA 8016, please visit the Office of Attorney General’s website at 
https://oag.ca.gov/fingerprints/forms. 


Dissemination/Use of CORI 

The CORI that an agency receives as a result of a criminal record background check may only be used for 
official purposes, and only for the specific purpose for which it was requested and provided. CORI may only be 
disclosed as specifically authorized by law. It may not be reproduced for secondary dissemination, transferred 
to, or shared with any other employing, licensing, or regulatory entity, or in response to a Public Records Act 
request. Unauthorized access, disclosure and/or misuse of CORI is a criminal offense.® 


Noncriminal Justice Agency Audits 
To ensure agency compliance with laws and regulations governing the handling and security of CORI, the DOJ 


3 See Civil Code § 1798.17. 

4 See 28 U.S.C. 534. 

5 See Penal Code §§ 11140 through 11144 (prescribing the penalties for misuse of criminal history record information); 
see also Government Code §§ 6200, 6201 (prescribing the penalties for the misuse of various government records, which 
include criminal history record information). 
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will begin periodically conducting audits of all agencies with access to CORI for noncriminal justice purposes. It 
is imperative for all applicant agencies to adhere to the requirements addressed in the Criminal Justice 
Information Services (CJIS) Security Policy to ensure the proper use and maintenance of CORI.® 


For questions about this Information Bulletin, please contact the Authorization and Certification Program at 


ORIQuestions@doj.ca.gov. 


Sincerely, 


A 
JOE DOMINIC, Chief/CIO 
California Justice Information Services Division 


For ROB BONTA 
Attorney General 


6 CJIS Security Policy, Section 5.11 Formal Audits. 


